@protobase/cli 0.66.6 → 0.66.8

package/dist/build/config-bundle.js

@@ -1,9 +1,12 @@
 import { findPackageDir, packageName } from "./packages/package-dir.js";
 import { hostModuleIds } from "../serve/host-module-ids.js";
+import { cliPackages } from "../dev/server-package.js";
+import { importProjectFiles } from "../project/import-project-file.js";
 import { loadSourceConfig } from "../config/source-config.js";
 import { layoutCheck } from "./layout-check.js";
 import { extensionImports } from "../project/extensions.js";
 import { viteBundle } from "./vite-bundle.js";
+import { cliProtobaseIds, provideCliModules } from "../project/cli-modules.js";
 import { collectComponents } from "./component-names.js";
 import { bundleEntryCode } from "./entry-code.js";
 import { hostPackages } from "./packages/host-packages.js";
@@ -67,9 +70,16 @@ const servedImports = (native) => {
 	};
 };
 const buildConfigBundle = async ({ projectDir, outFile, bun, extensions = [], components = /* @__PURE__ */ new Set() }) => {
+	if (process.versions.bun !== void 0) provideCliModules();
+	const cli = cliPackages();
+	const packages = {
+		...cli,
+		dedupe: [.../* @__PURE__ */ new Set([...cli.dedupe, ...cliProtobaseIds().map((id) => packageName(id))])]
+	};
 	const config = await loadSourceConfig(projectDir, {
 		command: "build",
-		extensions
+		extensions,
+		importModules: (files) => importProjectFiles(files, projectDir, packages)
 	});
 	const file = path.join(projectDir, "protobase-bundle-entry.js");
 	const native = /* @__PURE__ */ new Map();

package/dist/build/first-party-code.js

@@ -0,0 +1,22 @@
+import { firstPartyCodeKey } from "@protobase/schema/internal";
+import { sentryVitePlugin } from "@sentry/vite-plugin";
+//#region src/build/first-party-code.ts
+/**
+* Marks every script of a browser build as the app's own (see `firstPartyCodeKey`), with the error SDK's bundler
+* plugin and nothing else of it: no release, no source map upload and no telemetry. Silent, since it still warns that
+* it has no token to create the release it is told not to create.
+*/
+const firstPartyCode = () => sentryVitePlugin({
+	applicationKey: firstPartyCodeKey,
+	telemetry: false,
+	silent: true,
+	sourcemaps: { disable: true },
+	release: {
+		inject: false,
+		create: false,
+		finalize: false,
+		setCommits: false
+	}
+});
+//#endregion
+export { firstPartyCode };

package/dist/build/plugin-build.js

@@ -6,6 +6,7 @@ import { bundledImports } from "../project/bundled-imports.js";
 import { sharedModules } from "../project/shared-modules.js";
 import { pluginFieldTypes } from "./plugin-fields.js";
 import { layerPluginUtilities } from "./plugin-styles.js";
+import { firstPartyCode } from "./first-party-code.js";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import path from "node:path";
@@ -120,7 +121,8 @@ const buildPlugin = async ({ pluginDir, outDir, name, projectDir, ignore = [], s
 			pluginStyles(styles, styleCode(pluginDir, target.theme, [outDir, ...ignore])),
 			react(),
 			tailwindcss(),
-			layeredStyles()
+			layeredStyles(),
+			firstPartyCode()
 		],
 		worker: { rolldownOptions: { output: { sourcemapDebugIds: sourceMaps } } },
 		build: {

package/dist/build/shell.js

@@ -2,6 +2,7 @@ import { readPackageJson } from "./packages/package-dir.js";
 import { adminAppDir, uiEntry, uiPackageDir } from "../project/admin-app.js";
 import { projectUiPlugin } from "../project/project-ui.js";
 import { sharedModulesPlugin } from "../project/shared-modules.js";
+import { firstPartyCode } from "./first-party-code.js";
 import { pinnedNative } from "../mobile/pinned-packages.js";
 import { faviconLink } from "../project/favicon-link.js";
 import { themeLink } from "../project/theme-link.js";
@@ -69,7 +70,8 @@ const buildShell = async (outDir, sourceMapsDir) => {
 			faviconLink(),
 			serviceWorker(),
 			react(),
-			tailwindcss()
+			tailwindcss(),
+			firstPartyCode()
 		],
 		worker: { rolldownOptions: { output: { sourcemapDebugIds: sourceMaps } } },
 		build: {

package/dist/cli/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.66.6";
+var version = "0.66.8";
 //#endregion
 export { version };

package/dist/dev/entry.js

@@ -55,7 +55,7 @@ const ui = {
 	icons: projectIcons(projectDir)
 };
 const { admin, jobs } = projectAdmin(project, db, ui, reporter, upgradeWebSocket);
-await devJobs(db, jobs, admin.decryptField, project.mailer);
+if (process.env.PROTOBASE_DEV_JOBS !== "false") await devJobs(db, jobs, admin.decryptField, project.mailer);
 devRealtimePrune(admin);
 var entry_default = withDevServiceWorker(new Hono(), Boolean(project.notifications)).route("/", admin);
 /** Whether the auth store has a user yet, for the banner's sign-in line; undefined without one. */

package/dist/dev/run.js

@@ -25,6 +25,7 @@ const runDev = async (options, out) => {
 	process.env.PROTOBASE_PROJECT = options.projectDir;
 	process.env.PROTOBASE_EXTENSIONS = JSON.stringify(extensions);
 	process.env.PROTOBASE_DATABASE_URL = url;
+	process.env.PROTOBASE_DEV_JOBS = String(options.jobs ?? true);
 	const onApiExit = (code) => {
 		process.stderr.write(`error: the API process of protobase dev ended with exit code ${code}\n`);
 		server.close().then(() => process.exit(code || 1));
@@ -63,7 +64,7 @@ const runDev = async (options, out) => {
 	const started = await apiChild.start(`http://localhost:${port}`).catch(closeAndThrow);
 	apiReady(started);
 	const { anyUsers, authDrift } = started;
-	out(`protobase dev ready at http://localhost:${port}\n  project  ${options.projectDir}\n  api      http://localhost:${port}/api/v1 (docs at /api/docs)\n` + loginLine(anyUsers, process.env.npm_config_user_agent) + authDriftLines(authDrift));
+	out(`protobase dev ready at http://localhost:${port}\n  project  ${options.projectDir}\n  api      http://localhost:${port}/api/v1 (docs at /api/docs)\n` + (options.jobs === false ? "  jobs     off: no jobs run and no events are delivered (--no-jobs)\n" : "") + loginLine(anyUsers, process.env.npm_config_user_agent) + authDriftLines(authDrift));
 	return server;
 };
 //#endregion

package/dist/dev/server-package.js

@@ -6,6 +6,12 @@ import { fileURLToPath } from "node:url";
 const server = "@protobase/server";
 const supplied = [...new Set(hostModuleIds.map((id) => packageName(id)))];
 const cliDir = fileURLToPath(new URL("../..", import.meta.url));
+/** The CLI's own copies of the packages the serve runtime supplies, as a bundled project gets them. */
+const cliPackages = (ownDir = cliDir) => ({
+	from: "cli",
+	root: ownDir,
+	dedupe: supplied
+});
 /**
 * Where the API of `protobase dev` gets @protobase/server: from the project's node_modules when the project is locked,
 * so one that is not installed fails as any missing package does; otherwise, bundled, the CLI's own, with the other
@@ -17,11 +23,7 @@ const serverPackage = (projectDir, ownDir = cliDir) => {
 		root: projectDir,
 		dedupe: [server]
 	};
-	return {
-		from: "cli",
-		root: ownDir,
-		dedupe: supplied
-	};
+	return cliPackages(ownDir);
 };
 //#endregion
-export { serverPackage };
+export { cliPackages, serverPackage };

package/dist/doctor/built-in-models.js

@@ -0,0 +1,26 @@
+import { builtInResources, configExports, webhooksModule } from "@protobase/server/config-exports";
+//#region src/doctor/built-in-models.ts
+/**
+* The resources and views Protobase adds to an app by what its config enables, as the API serves them: the webhook ones
+* of `webhooks`, then Failed jobs, Activity and Comments by what the app's resources use. Doctor checks them as it checks
+* the app's own.
+*/
+const builtInModels = (config, models) => {
+	const webhooks = config.webhooks ? configExports(webhooksModule(config.webhooks)) : {
+		resources: [],
+		views: []
+	};
+	const webhookModels = webhooks.resources.map((resource) => resource.toModel());
+	const added = builtInResources({
+		models: [...webhookModels, ...models],
+		jobs: Object.keys(config.jobs).length > 0,
+		notifications: config.notifications !== void 0,
+		...config.events && { events: config.events }
+	});
+	return {
+		models: [...webhookModels, ...added.resources.map((resource) => resource.toModel())],
+		views: [...webhooks.views, ...added.views].map((view) => view.toModel())
+	};
+};
+//#endregion
+export { builtInModels };

package/dist/doctor/run.js

@@ -1,7 +1,9 @@
+import { loadSourceConfig } from "../config/source-config.js";
 import { connect } from "../db/connect.js";
 import { introspect } from "../db/introspect.js";
 import { loadDataConfig } from "../project/load-data-config.js";
 import { readOnlyDb } from "../db/read-only-db.js";
+import { builtInModels } from "./built-in-models.js";
 import { checkResource } from "./check.js";
 import { indexIssues } from "./index-issues.js";
 import { readShapes } from "./read-shapes.js";
@@ -15,12 +17,17 @@ const format = (issue) => `  ${issue.severity.padEnd(7)} ${issue.resource}: ${is
 const runDoctor = async (options, out) => {
 	if (!existsSync(path.join(options.configDir, "index.ts"))) throw new Error(`No config in ${options.configDir}: write it with \`protobase scaffold\`, or pass --config <dir>`);
 	const config = await loadDataConfig(options.configDir, options.projectDir);
-	const { models } = config;
-	if (models.length === 0) throw new Error(`No resources exported from ${options.configDir}/index.ts`);
+	if (config.models.length === 0) throw new Error(`No resources exported from ${options.configDir}/index.ts`);
+	const builtIn = builtInModels(await loadSourceConfig(options.projectDir, { command: "tool" }), config.models);
+	const models = [...builtIn.models, ...config.models];
 	const sql = connect(options.url);
 	const tables = await introspect(sql, { views: true }).finally(() => sql.end());
 	const db = readOnlyDb(options.url);
-	const shapes = readShapes(config);
+	const shapes = readShapes({
+		models,
+		views: [...builtIn.views, ...config.views],
+		pages: config.pages
+	});
 	const indexes = await Promise.all(models.map(async (model) => indexIssues(model, await tableIndexes(db, model), shapes))).finally(() => db.destroy());
 	const issues = models.flatMap((model, i) => [
 		...checkResource(model, tables),
@@ -30,7 +37,7 @@ const runDoctor = async (options, out) => {
 	]);
 	for (const issue of issues) out(format(issue));
 	const errors = issues.filter((i) => i.severity === "error").length;
-	out(`Checked ${models.length} resources: ${errors} errors, ${issues.length - errors} warnings.\n`);
+	out(`Checked ${builtIn.models.length > 0 ? `${config.models.length} resources and ${builtIn.models.length} built-in ones` : `${models.length} resources`}: ${errors} errors, ${issues.length - errors} warnings.\n`);
 	return {
 		errors,
 		warnings: issues.length - errors

package/dist/main.js

@@ -60,7 +60,7 @@ program.command("doctor").description("Check a config folder against the databas
 	}, out);
 	if (errors > 0) process.exitCode = 1;
 });
-program.command("dev").description("Serve the admin app and API for the project in the current directory").option("--port <port>", "port for the app and API", "5173").option("--env <variable>", "environment variable holding the database URL", "DATABASE_URL").option("--allowed-hosts <hosts>", "extra Host headers to accept, comma separated; a leading dot matches subdomains (.trycloudflare.com)").option("--cache-dir <dir>", "Vite's dependency cache, so parallel dev servers do not share one").option("--extend <dir>", "merge the protobase.config.ts and protobase.ui.tsx in this folder before the project's, repeatable", collect, []).action(async (opts) => {
+program.command("dev").description("Serve the admin app and API for the project in the current directory").option("--port <port>", "port for the app and API", "5173").option("--env <variable>", "environment variable holding the database URL", "DATABASE_URL").option("--allowed-hosts <hosts>", "extra Host headers to accept, comma separated; a leading dot matches subdomains (.trycloudflare.com)").option("--cache-dir <dir>", "Vite's dependency cache, so parallel dev servers do not share one").option("--extend <dir>", "merge the protobase.config.ts and protobase.ui.tsx in this folder before the project's, repeatable", collect, []).option("--no-jobs", "run none of the app's jobs and deliver none of its events, such as against its hosted database").action(async (opts) => {
 	const [{ runDev }, { resolveExtensions }, { writeProjectTypes }] = await Promise.all([
 		import("./dev/run.js"),
 		import("./project/extensions.js"),
@@ -73,7 +73,8 @@ program.command("dev").description("Serve the admin app and API for the project
 		envVar: opts.env,
 		projectDir: process.cwd(),
 		cacheDir: opts.cacheDir && path.resolve(opts.cacheDir),
-		allowedHosts: parseHosts(opts.allowedHosts)
+		allowedHosts: parseHosts(opts.allowedHosts),
+		jobs: opts.jobs
 	}, out);
 	warn(placeholderSecretWarning(process.env));
 	process.once("SIGINT", () => void server.close().then(() => process.exit(0)));

package/dist/mobile/android-signing.js

@@ -12,6 +12,13 @@ const signingNames = new Set(androidSigningVariables);
 const isSigningVariable = (key) => signingNames.has(key.toUpperCase());
 /** `env` without the signing variables, in any letter case. */
 const withoutAndroidSigning = (env) => Object.fromEntries(Object.entries(env).filter(([key]) => !isSigningVariable(key)));
+/**
+* Deletes from `env`, in place, every variable named `PROTOBASE_ANDROID_*` in any letter case: wider than the four, so
+* no such variable is left for the project's code to find, while Gradle, which reads the four by name, gets them apart.
+*/
+const dropAndroidSigning = (env) => {
+	for (const key of Object.keys(env)) if (key.toUpperCase().startsWith("PROTOBASE_ANDROID_")) delete env[key];
+};
 const isFile = (file) => {
 	try {
 		return statSync(file).isFile();
@@ -50,4 +57,4 @@ const withReleaseSigning = (gradle) => {
 	return gradle.replace(releaseAnchor, `${signingConfig}${releaseAnchor}            signingConfig signingConfigs.release\n`);
 };
 //#endregion
-export { androidSigning, androidSigningVariables, withReleaseSigning, withoutAndroidSigning };
+export { androidSigning, androidSigningVariables, dropAndroidSigning, withReleaseSigning, withoutAndroidSigning };

package/dist/mobile/load-project.js

@@ -1,14 +1,17 @@
 import { loadNearestEnvFile } from "../dev/env.js";
 import { loadSourceConfig } from "../config/source-config.js";
+import { dropAndroidSigning } from "./android-signing.js";
 import { appNameOver } from "@protobase/server";
 //#region src/mobile/load-project.ts
 /**
 * What a mobile build needs of the project in `dir`, merged as `protobase dev` merges it after the configs of
 * `extensions`: its mobile section, unchecked, and with sign-in on the app's URL, its tokens' issuer, and its name.
-* The project's .env is loaded first, as other commands do; nothing but the configs runs.
+* The project's .env is loaded first, as other commands do, and no `PROTOBASE_ANDROID_*` variable is left in the
+* environment; nothing but the configs runs.
 */
 const loadMobileProject = async (dir, extensions) => {
 	loadNearestEnvFile(dir);
+	dropAndroidSigning(process.env);
 	const { mobile, auth, url, name } = await loadSourceConfig(dir, {
 		command: "tool",
 		extensions

package/dist/project/cli-modules.js

@@ -0,0 +1,30 @@
+import { cliTypePaths } from "./project-types.js";
+import { fileURLToPath } from "node:url";
+//#region src/project/cli-modules.ts
+const cliDir = fileURLToPath(new URL("../..", import.meta.url));
+/** Every entry point of the @protobase packages the CLI carries, such as `@protobase/server/pdf`. */
+const cliProtobaseIds = () => Object.keys(cliTypePaths()).filter((id) => id.startsWith("@protobase/"));
+/**
+* Under Bun, makes every later import of an entry point of the @protobase packages load the CLI's own copy, whatever
+* the importer installed (Bun's virtual modules). Each loads when it is first imported, so the CLI loads nothing it did
+* not already load or the project does not import. Only the @protobase packages: a virtual module that loads lazily
+* cannot be `require`d, as the CLI requires React. Bun only: under Node the project's files load through Vite's module
+* runner, which resolves them from the CLI itself. Each build calls it again, which Bun takes: a plugin of the same name
+* registered again replaces nothing it needs and throws nothing.
+*/
+const provideCliModules = () => {
+	const bun = globalThis.Bun;
+	if (!bun) throw new Error("provideCliModules runs under Bun only");
+	const ids = cliProtobaseIds();
+	bun.plugin({
+		name: "protobase-cli-modules",
+		setup: (build) => {
+			for (const id of ids) build.module(id, async () => ({
+				exports: await import(bun.resolveSync(id, cliDir)),
+				loader: "object"
+			}));
+		}
+	});
+};
+//#endregion
+export { cliProtobaseIds, provideCliModules };

package/dist/project/import-project-file.js

@@ -3,10 +3,9 @@ import { writeProjectTypes } from "./project-types.js";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/project/import-project-file.ts
-const runnerImport = async (file, projectDir, plugins = []) => {
+const runnerImport = async (file, projectDir, resolution, plugins = []) => {
 	await writeProjectTypes(projectDir);
 	const vite = await import("vite");
-	const resolution = serverPackage(projectDir);
 	const packages = resolution.from === "cli" ? {
 		root: resolution.root,
 		resolve: { dedupe: resolution.dedupe }
@@ -23,29 +22,30 @@ const inPackage = (file) => file.split(path.sep).includes("node_modules");
 const bunLoads = (projectDir) => process.versions.bun !== void 0 && serverPackage(projectDir).from === "project";
 /**
 * Imports one of the files of the project in `projectDir`, TypeScript: Bun loads it itself, Node through Vite's module
-* runner, or a package's file as it is. A bundled project's file always goes through the runner. `protobase dev` loads
-* this module through Vite, which leaves these imports of a path as they are.
+* runner, or a package's file as it is. A bundled project's file always goes through the runner. `resolution` says whose
+* packages the runner resolves, by default as `serverPackage` says. `protobase dev` loads this module through Vite,
+* which leaves these imports of a path as they are.
 */
-const importProjectFile = async (file, projectDir) => inPackage(file) ? import(
+const importProjectFile = async (file, projectDir, resolution = serverPackage(projectDir)) => inPackage(file) ? import(
 	/* @vite-ignore */
 	pathToFileURL(file).href
 ) : bunLoads(projectDir) ? import(
 	/* @vite-ignore */
 	file
-) : runnerImport(file, projectDir);
+) : runnerImport(file, projectDir, resolution);
 /**
 * Imports several of the project's files in order, so that the modules they share are loaded once. Bun's module cache
 * does that itself; Vite's runner gets them as the imports of one module, which need not exist, beside the first file.
 */
-const importProjectFiles = async (files, projectDir) => {
+const importProjectFiles = async (files, projectDir, resolution = serverPackage(projectDir)) => {
 	if (bunLoads(projectDir) || files.length === 1) {
 		const modules = [];
-		for (const file of files) modules.push(await importProjectFile(file, projectDir));
+		for (const file of files) modules.push(await importProjectFile(file, projectDir, resolution));
 		return modules;
 	}
 	const id = path.join(path.dirname(files[0]), "protobase-project-files.js");
 	const code = [...files.map((file, i) => `import * as m${i} from ${JSON.stringify(file)}`), `export const modules = [${files.map((_, i) => `m${i}`).join(", ")}]`].join("\n");
-	return (await runnerImport(id, projectDir, [{
+	return (await runnerImport(id, projectDir, resolution, [{
 		name: "protobase-project-files",
 		resolveId: (source) => source === id ? `\0${id}` : void 0,
 		load: (source) => source === `\0${id}` ? code : void 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/cli",
-  "version": "0.66.6",
+  "version": "0.66.8",
   "description": "The protobase command: scaffold, doctor, dev, build and serve a Protobase project.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,14 +43,15 @@
   "dependencies": {
     "@better-auth/core": "^1.7.12",
     "@hono/node-server": "^2.1.3",
-    "@protobase/config": "0.66.6",
-    "@protobase/layout": "0.66.6",
-    "@protobase/query": "0.66.6",
-    "@protobase/schema": "0.66.6",
-    "@protobase/server": "0.66.6",
-    "@protobase/ui": "0.66.6",
+    "@protobase/config": "0.66.8",
+    "@protobase/layout": "0.66.8",
+    "@protobase/query": "0.66.8",
+    "@protobase/schema": "0.66.8",
+    "@protobase/server": "0.66.8",
+    "@protobase/ui": "0.66.8",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
+    "@sentry/vite-plugin": "^11.10.0",
     "@tailwindcss/vite": "^4.3.3",
     "@vitejs/plugin-react": "^6.1.2",
     "aip-parsers": "^1.0.0",

package/skills/protobase/references/features/ai.md

@@ -6,16 +6,19 @@ Fields and actions filled by a model, the assistant beside the admin, and MCP.
 
 - [AI fields](../reference/ai.md#ai-fields): A model fills a field from a prompt that uses the record's other fields, after each change.
 - [AI actions](../reference/ai.md#ai-actions): A button asks a model to write a field now, such as a suggested priority or a translation.
-- [Assistant](../reference/assistant.md): A chat beside the admin that answers questions about the app, reads its data and proposes changes for approval.
+- [Assistant](../reference/assistant.md) (beta): A chat beside the admin that answers questions about the app, reads its data and proposes changes for approval.
 - [Choice of model](../reference/assistant.md#which-backend): The assistant runs on OpenRouter or any OpenAI-compatible endpoint, also a local one.
-- [Assistant tools](../reference/assistant.md#the-apps-own-tools): Your own tools for the assistant, acting on records as the user.
-- [MCP server](../reference/mcp.md#the-tools): AI clients connect to the app over MCP as the signed-in person: they list the resources in a small first call, describe one resource's fields when they need them, and find and read records within that person's access, soft-deleted ones too when asked.
+- [Assistant tools](../reference/assistant.md#the-apps-own-tools) (beta): Your own tools for the assistant, acting on records as the user.
+- [Assistant widgets](../reference/assistant.md#widget-parts): Your own React components in the chat, showing a record as it is now and taking decisions on it, from last month's chat too.
+- [Assistant backend of your own](../reference/assistant.md#another-backend): The chat beside the admin talks to a backend elsewhere, with its own prompt and tools, built from the same pieces as the built-in one.
+- [MCP server](../reference/mcp.md#the-tools) (beta): AI clients connect to the app over MCP as the signed-in person: they list the resources in a small first call, describe one resource's fields when they need them, and find and read records within that person's access, soft-deleted ones too when asked.
 - [MCP read fields](../reference/mcp.md#reading-only-what-is-needed): AI clients read only the fields they name, a plain list returns the columns of the app's table, and the server tells clients how to keep reads small.
-- [MCP counts](../reference/mcp.md#the-tools): AI clients count the records a filter finds, in all or per value of a field such as a status, without reading the records.
-- [MCP app icon](../reference/mcp.md#the-apps-icon): AI clients show the app's own icon beside its name when someone adds its MCP endpoint.
-- [MCP writes](../reference/mcp.md#writes): When turned on, for every resource or only those you list, AI clients create, update and delete records after the person approves each write.
+- [MCP counts](../reference/mcp.md#the-tools) (beta): AI clients count the records a filter finds, in all or per value of a field such as a status, without reading the records.
+- [MCP app icon](../reference/mcp.md#the-apps-icon) (beta): AI clients show the app's own icon beside its name when someone adds its MCP endpoint.
+- [MCP SQL for admins](../reference/mcp.md#sql-for-admins): People with the `admin` or `ai` role run read-only SQL over MCP when you turn it on.
+- [MCP writes](../reference/mcp.md#writes) (beta): When turned on, for every resource or only those you list, AI clients create, update and delete records after the person approves each write.
 - [Small MCP write results](../reference/mcp.md#what-a-write-returns): A write over MCP returns the record's key, new ETag, the fields written and the read-only fields that changed, not the whole record; `fields` asks for more.
-- [MCP writes without approval](../reference/mcp.md#writes-without-approval): Roles you name, such as service accounts, write over MCP without being asked to approve each write; everyone else is still asked.
+- [MCP writes without approval](../reference/mcp.md#writes-without-approval) (beta): Roles you name, such as service accounts, write over MCP without being asked to approve each write; everyone else is still asked.
 - [MCP comments](../reference/mcp.md#comments): AI clients read a record's comments, and with MCP writes on add one after the person approves it.
 - [MCP batch writes](../reference/mcp.md#batch-writes): When MCP writes are on, AI clients make many creates, updates and deletes across resources in one transaction, after the person approves the batch.
 - [Connected apps](../reference/auth.md#oauth-for-mcp-clients): People allow an AI client to sign in, and disconnect it later.

package/skills/protobase/references/features/build-and-run.md

@@ -6,6 +6,7 @@ Develop, build and run an app, on servers, in containers and on phones.
 
 - [Node and Bun](../reference/cli.md#how-it-runs): The `protobase` command runs on Node 22.12 or later or on Bun, and a bundle runs on both unless it is built for Bun only.
 - [Dev server](../reference/cli.md#dev): The admin app and the API on one port, with changes shown without a restart.
+- [Dev server without jobs](../reference/cli.md#dev): `protobase dev --no-jobs` runs no jobs and delivers no events, webhooks or pushes, to develop against a hosted app's database without doing its work twice.
 - [Editor types](../reference/cli.md#types): `protobase types` gives the editor and `tsc` the types of the CLI that builds the app, with nothing installed.
 - [Project scripts](../reference/cli.md#run): `protobase run` runs a seed or a migration script on the CLI's packages.
 - [Migrate command](../reference/cli.md#migrate): `protobase migrate` applies the project's SQL migrations in one transaction, with nothing installed.

package/skills/protobase/references/features/compatibility.md

@@ -6,10 +6,10 @@ Apps written for other systems that keep working on Protobase, and moving their
 
 ## Supabase
 
-- [Supabase import](../reference/cli.md#import-supabase): Moves a Supabase project into Protobase, with schema, data, users, functions, storage and scheduled jobs.
-- [Create a project on a Supabase database](../getting-started.md#on-an-existing-database) (beta): your Supabase users sign in to the new project with their own passwords, and Supabase's own auth schema stays as Supabase set it up.
-- [Supabase client API](../reference/supabase-rest.md): supabase-js `from()` and `rpc()` calls keep working, under the tables' RLS policies.
-- [Supabase Auth](../reference/auth.md#supabase-js-and-supabasessr): `supabase.auth` and `@supabase/ssr` calls keep working.
-- [Supabase Storage](../reference/supabase-storage.md): supabase-js storage calls keep working, over the app's file storage.
-- [Supabase Realtime](../reference/supabase-realtime.md): Database changes, broadcast and presence through supabase-js channels, private ones authorized by the policies on `realtime.messages`, broadcasts sent from a server without joining a channel, and broadcasts from the database with `realtime.send()` and `realtime.broadcast_changes()`, across [several processes](../reference/supabase-realtime.md#several-processes) serving one app.
+- [Supabase import](../reference/cli.md#import-supabase) (beta): Moves a Supabase project into Protobase, with schema, data, users, functions, storage and scheduled jobs, and a coding agent's skill finishes what its report leaves.
+- [Create a project on a Supabase database](../getting-started.md#on-a-supabase-database) (beta): your Supabase users sign in to the new project with their own passwords, and Supabase's own auth schema stays as Supabase set it up.
+- [Supabase client API](../reference/supabase-rest.md) (beta): supabase-js `from()` and `rpc()` calls keep working, under the tables' RLS policies.
+- [Supabase Auth](../reference/auth.md#supabase-js-and-supabasessr) (beta): `supabase.auth` and `@supabase/ssr` calls keep working.
+- [Supabase Storage](../reference/supabase-storage.md) (beta): supabase-js storage calls keep working, over the app's file storage.
+- [Supabase Realtime](../reference/supabase-realtime.md) (beta): Database changes, broadcast and presence through supabase-js channels, private ones authorized by the policies on `realtime.messages`, broadcasts sent from a server without joining a channel, and broadcasts from the database with `realtime.send()` and `realtime.broadcast_changes()`, across [several processes](../reference/supabase-realtime.md#several-processes) serving one app.
 - [Edge Functions](../guides/api-functions.md#functions-moved-from-supabase): Functions moved from Supabase answer at their old addresses.

package/skills/protobase/references/features/data-model.md

@@ -18,7 +18,7 @@ Describe the tables of an existing Postgres database as resources, with their fi
 - [Record validation](../reference/data-config.md#resource): A rule over the whole record runs on every create and update and reports each problem on the field it concerns.
 - [Rollups and formulas](../reference/data-config.md#rollups-and-formulas) (beta): Fields that hold counts, sums, averages, minimums or maximums of related records, or values calculated from the record's own numbers, kept current by the database.
 - [Sensitive fields](../reference/data-config.md#sensitive-fields): Values such as bank account numbers are left out of every response and shown masked. A permitted user reveals one value at a time, and each reveal is audited.
-- [Recent strong sign-in](../reference/data-config.md#recent-strong-sign-in): A sensitive field can ask for a passkey or a second step in the last minutes before it is revealed. The record page asks the person to confirm it's them, then shows it.
+- [Recent strong sign-in](../reference/data-config.md#recent-strong-sign-in): A sensitive field can ask for a passkey or a second step in the last minutes before it is revealed, or an emailed code for an account with neither. The record page asks the person to confirm it's them, then shows it.
 - [Computed reveals](../reference/data-config.md#computed-reveals) (beta): A secret kept elsewhere, or built from several values, is revealed like a sensitive field, with the same access, audit and recent sign-in check, but made when it is asked for.
 - [Encrypted fields](../reference/data-config.md#encrypted-fields): A sensitive text field is encrypted with the app's own key before it is stored, so dumps, backups and SQL readers see only ciphertext. A command encrypts the values a column already holds.
 - [Encrypted fields in jobs and functions](../reference/data-config.md#reading-in-jobs-and-functions) (beta): A job or an API function reads an encrypted value the app must use itself, such as a share's password, and each read is audited like a reveal.

package/skills/protobase/references/features/email-and-public-forms.md

@@ -7,6 +7,8 @@ Mail the app sends, the PDF documents it makes, and forms for people without an
 - [Email](../reference/email.md#configuration): The app sends mail through one SMTP server or a mailer you supply.
 - [Built-in emails](../reference/email.md#protobases-own-mail): Sign-in codes, password resets, invitations and mentions are sent in the app's name.
 - [Email templates](../reference/email.md#templates): Your own emails are React components with typed data, sent from jobs, hooks or functions.
+- [Protobase's mail look](../reference/email.md#the-look-of-protobases-own-mail): Your emails use the layout, button, code and note that Protobase's own mail is built from.
+- [Unsubscribe headers](../reference/email.md#templates): Your emails carry header fields of their own, such as a one-click unsubscribe link for bulk mail.
 - [Attachments](../reference/email.md#attachments): A message carries files, such as an invoice's PDF, through the app's mail or someone's own mailbox.
 - [PDF documents](../reference/pdf.md#documents): PDF files such as invoices and quotes are React components with typed data, rendered from jobs, hooks or functions and attached to mail as they are.
 - [Mail from your own mailbox](../reference/email.md#from-someones-own-mailbox) (beta): People link their Gmail on the account page, and the app's functions send mail from it, with a clear error when the link is missing or expired.

package/skills/protobase/references/features/events-webhooks-and-jobs.md

@@ -10,10 +10,12 @@ React to changes, deliver them to other systems, and run work in the background.
 - [Signed webhooks](../reference/webhooks.md#what-a-receiver-gets): Deliveries are signed under the Standard Webhooks spec.
 - [Delivery retries](../reference/webhooks.md#delivery-and-retries): Failed deliveries are retried for about three days.
 - [Webhooks in the admin app](../reference/webhooks.md#subscriptions-in-the-admin-app): Users create subscriptions, send test events and resend failures in the app.
+- [Webhook delivery log](../reference/webhooks.md#subscriptions-in-the-admin-app): Every try of the admin app's subscriptions, successes too, is kept for 30 days with its status and timing, when the app turns it on.
 - [Background jobs](../reference/jobs.md#enqueueing): Jobs are kept in the app's own Postgres and can be queued in the same transaction as a write, also from SQL.
 - [Typed jobs](../reference/jobs.md#typed-names-and-payloads): Code that queues a job, and the job itself, are checked against the names and arguments the config declares as they compile.
 - [Retries](../reference/jobs.md#failures): Failed jobs are retried with growing waits, and duplicates can be prevented with a key.
 - [Ordered groups](../reference/jobs.md#ordered-groups): Jobs in one group run one at a time, in order.
 - [Recurring jobs](../reference/jobs.md#recurring-jobs): Jobs run on a cron schedule in a chosen time zone.
 - [Failed jobs page](../reference/jobs.md#failed-jobs-page): Admins see jobs that failed for good and retry or delete them.
+- [Worker process](../reference/jobs.md#where-jobs-run): Jobs and event deliveries run beside the API, or in a worker process of their own from the same bundle.
 - [Jobs on hosts that sleep](../reference/jobs.md#hosts-that-sleep): A host that stops idle apps can wake them when a job is due.

package/skills/protobase/references/features/files-and-images.md

@@ -5,6 +5,7 @@
 Uploaded files and images, where they are kept and how they are served.
 
 - [File fields](../reference/files.md#what-the-column-holds): A text column holds an uploaded file, with limits on type and size.
+- [File uploads in forms](../reference/files.md#in-forms): Forms upload a dropped or chosen file at once with a progress bar, and replace or remove it; tables show its name and a thumbnail.
 - [File storage](../reference/files.md#providers): Files are kept on disk, or in a bucket of your own.
 - [S3-compatible buckets](../reference/files.md#s3-compatible-buckets) (beta): Files are kept in any bucket that speaks the S3 API, when the app runs on Bun.
 - [Files from a seed](../reference/files.md#writing-files-from-a-seed): A seed or another script writes files into the app's providers, read from its config and environment as the server reads them.

package/skills/protobase/references/features/history-comments-and-live-updates.md

@@ -12,5 +12,6 @@ The changes of each record, comments on it, and pages that refresh as records ch
 - [Comment moderation](../reference/comments.md#moderation): Admins find and delete comments across the app.
 - [Live updates](../reference/live.md#what-a-page-hears): Open lists and record pages refresh within seconds when a record changes, including changes made outside the API.
 - [Change stream](../reference/live.md#the-stream): Apps follow record changes over a stream that catches up after a reconnect.
+- [Polling, then a socket](../reference/live.md#polling-then-a-socket): Apps and Node scripts poll for changes first and switch to a WebSocket after 30 seconds, or at once, falling back to polling while the socket is down.
 - [Presence](../reference/channels.md#presence) (beta): Apps see who else has a record open and what each of them tracks, such as online or away, for whoever may read the record.
 - [Broadcasts](../reference/channels.md#broadcasts) (beta): Apps on a record send each other short-lived events, such as typing, which are never stored, as JSON or as bytes, such as a chunk of audio or a drawing stroke; the app's own code sends them too, from an API function, over HTTP or [from SQL](../reference/channels.md#from-sql) with `channels.send()`.

package/skills/protobase/references/features/look-and-language.md

@@ -8,6 +8,7 @@ The app's colours, name, icon, language and installation.
 - [Dark mode](../reference/theme.md#light-dark-or-the-system): Each user picks light, dark or the system setting.
 - [App name, icon and colours](../reference/app-identity.md): The app's own name, icon and colours in the sidebar, browser tabs, `/favicon.ico`, home-screen icon and mail.
 - [Logo and favicon](../reference/theme.md#logo-and-favicon): Your own favicon or logo replaces Protobase's.
+- [Named icons](../reference/layouts.md#named-actions): Actions, key facts and card meta show an icon picked by name from a set, such as `play`, `bed` or `cpu`.
 - [English and Dutch](../reference/languages.md): The built-in screens come in English and Dutch, with numbers and dates written to match.
 - [Installable app](../reference/installable-app.md): The admin installs as an app on phones and computers, and says when the server cannot be reached.
 - Reduced motion: When the system asks for less motion, animations and pulsing dots stop.

package/skills/protobase/references/features/navigation.md

@@ -4,14 +4,15 @@
 
 The sidebar, the user menu, the bottom bar on phones and the global search.
 
-- [Sidebar](../reference/sidebar.md): Resources and pages in groups, in the order you set.
+- [Sidebar](../reference/sidebar.md): Resources and pages in groups, in the order you set, and a drawer on phones.
 - [Sidebar icons](../reference/sidebar.md#sidebar-icons): Each resource shows the icon its view names in the sidebar, bottom bar and profile menu.
-- [Recent records](../reference/sidebar.md#recent-records): A sidebar entry lists a few records under it, with status dots or as titles alone, and marked per reader, such as unread ones in bold with a count.
+- [Recent records](../reference/sidebar.md#recent-records) (beta): A sidebar entry lists a few records under it, with status dots or as titles alone, and marked per reader, such as unread ones in bold with a count.
 - [Create link](../reference/sidebar.md#create-link): A sidebar entry links to its create form, such as "New message" under Direct messages, for whoever may create.
 - [The current organization](../reference/sidebar.md#the-current-organization): A sidebar entry opens its list on the organization you work in, which you can clear to see every organization you are a member of.
 - [User menu](../reference/user-menu.md): Account pages, help links, security settings, setting a status, the theme switch and Sign out.
 - [Bottom bar](../reference/bottom-bar.md): On phones, tabs along the bottom for each role's main screens.
 - [Global search](../reference/client.md#global-search): A search box, also on Cmd+K or Ctrl+K, finds records in every resource and jumps to pages and New forms.
-- Breadcrumbs: The top bar shows the group, list and record you are on, each a link back.
-- Update notice: When the server runs a newer Protobase version, open pages offer a reload so the user can save their work first.
+- [Breadcrumbs](../reference/ui-config.md#breadcrumbs): The top bar shows the group, list and record you are on, each a link back, and on a phone a back button to the one before.
+- [Tab titles](../reference/ui-config.md#names-and-columns): Browser tabs name the record, list or page they show, then the app.
+- [Update notice](../reference/versioning.md#a-new-version-under-an-open-page): When the server runs a newer Protobase version, open pages offer a reload so the user can save their work first.
 - Config refresh: When the config or the user's roles change, open pages load the new menus, columns and permissions without a reload.

package/skills/protobase/references/features/sign-in-and-accounts.md

@@ -5,12 +5,15 @@
 Sign-in methods, users, roles, organizations and tokens.
 
 - [Built-in sign-in](../reference/auth.md): Password sign-in, sessions and short-lived tokens, with no separate identity service.
+- [Sign-in page](../reference/client.md#the-admin-app): The app signs people in at its own address, where the browser's Back returns to the step before, and signing in comes back to the page they were on.
 - [First admin](../reference/auth.md#first-run): No account can be made over the web while the app has no users. You create the first admin from the terminal, and the last active admin cannot be deleted, demoted or blocked.
 - [Users from a script](../reference/auth.md#first-run): A seed or another script of the project creates and lists users, and mints their tokens, on the app's own sign-in.
 - [Versioned sign-in tables](../reference/auth.md#migrations): The sign-in tables come from numbered migrations that ship with Protobase, written as the project's own and recorded in the database, so a deploy checks them without comparing tables. Every feature has its tables from the start, so turning one on or off needs no migration.
 - [Existing users table](../reference/auth.md#an-existing-users-table): Sign-in can use the users table another system keeps in the same database.
 - [Users page](../reference/auth.md#users-page): Admins find people, set roles, block them, add accounts and invite people by email.
+- [Account page](../reference/auth.md#account-page): Everyone signed in has an account page for their profile, sign-in and security, devices and connected apps, and you add, hide or reorder its tabs.
 - [Password reset](../reference/auth.md#password-reset): People reset a forgotten password through an emailed link.
+- [Password changes](../reference/auth.md#name-password-and-devices): Changing the password signs out every other device and MCP client, and emails the account that its password changed. Guesses at the current password are limited for each account.
 - [Leaked passwords](../reference/auth.md#leaked-passwords): New passwords that appear in a known data breach are refused, when the app turns the check on.
 - [Emailed sign-in codes](../reference/auth.md#emailed-sign-in-codes): People sign in with a code sent to their email. An address with no account is emailed that it has none, so the person tries the one they signed up with. An app can have the sign-in page lead with the code and put the password behind "Use a password".
 - [Changing the address](../reference/auth.md#changing-the-address): People move their account to a new email address from the account page, once they enter the code sent there.
@@ -18,8 +21,12 @@ Sign-in methods, users, roles, organizations and tokens.
 - [Open sign-up](../reference/auth.md#open-sign-up): Anyone can create an account after confirming an emailed code.
 - [Passkeys](../reference/auth.md#passkeys): People sign in with their device's face or fingerprint unlock, or with a security key.
 - [Two-factor authentication](../reference/auth.md#two-factor-authentication): A second step with an authenticator app, backup codes or emailed codes.
+- [Emailed confirmation code](../reference/auth.md#emailed-confirmation-code): Someone without a passkey or a second step confirms it's them with a code emailed on request, where they are, such as before a secret is shown.
+- [Confirming an account change](../reference/auth.md#confirming-an-account-change): Adding a passkey, unlinking a provider or deleting the account from an older session asks to confirm it's them in place, never to sign out and sign in again.
 - [Sign-in policy](../reference/auth.md#sign-in-policy): Admins choose which sign-in methods are on, off or required, and the server refuses a policy that would lock people out.
 - [GitHub and social sign-in](../reference/auth.md#sign-in-with-github): People sign in with GitHub or another social provider.
+- [Sign-in links](../reference/auth.md#sign-in-links-and-connected-accounts): A link signs someone in with a sign-in provider at once, without the sign-in page.
+- [Connected accounts](../reference/auth.md#sign-in-links-and-connected-accounts): People link GitHub or another sign-in provider to their account from the account page.
 - [SAML sign-in](../reference/auth.md#sign-in-with-saml): People sign in through any SAML provider.
 - [OpenID Connect provider](../reference/auth.md#platform-sign-in-provider): A host adds an OpenID Connect provider for people who already have an account.
 - [Staff sign-in](../reference/auth.md#staff-sign-in): The team that runs an app signs in as a person to help them, with a reason and a log entry.

package/skills/protobase/references/features/start-a-project.md

@@ -19,7 +19,8 @@ Start a new app, or an admin over an existing Postgres database, and keep the co
 - [Scaffold from a database](../reference/cli.md#scaffold): Reads your Postgres tables and writes the data config for them, with field types, keys, relations, enums, soft delete, tenants and search filled in, and with `--ui` a first view of each.
 - [Safe re-scaffolding](../reference/cli.md#re-running): Running scaffold again adds only the columns that are not declared yet and leaves your own config code as it is.
 - [Schema drift report](../reference/cli.md#drift-report): After each scaffold, lists declared fields whose column is gone, whose type changed or whose enum values differ, with a suggested fix.
-- [Doctor](../reference/cli.md#doctor): Checks every resource and view against the database, including reads that lack an index, and prints the fix for each problem.
+- [Doctor](../reference/cli.md#doctor): Checks every resource and view against the database, the ones Protobase adds such as webhook subscriptions included, with the reads that lack an index, and prints the fix for each problem.
 - [Admin without a view](../guides/table-to-admin.md#1-the-table-as-it-is): A table with an empty view already gives a working admin with every column, sorting, paging, a record page and a New button.
 - [Agent skills](../reference/cli.md#skill): `protobase skill install` writes agent skills that match the installed version into the project, for the coding agents that work on it.
 - [Docs as Markdown](../getting-started.md#docs-as-markdown): Every docs page is also Markdown at its address plus `.md`, for coding agents and chat assistants.
+- [llms.txt](../getting-started.md#docs-as-markdown): The docs site serves `/llms.txt`, which links every page's Markdown, and the protobase agent skill at `/skills/protobase/SKILL.md`, for chat assistants.